diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
index 6f3cd68..4b90989 100644
--- a/src/p2p/p2p.c
+++ b/src/p2p/p2p.c
@@ -2990,6 +2990,10 @@
 	p2p->pending_action_state = P2P_NO_PENDING_ACTION;
 	switch (state) {
 	case P2P_NO_PENDING_ACTION:
+		if (p2p->send_action_in_progress) {
+			p2p->send_action_in_progress = 0;
+			p2p->cfg->send_action_done(p2p->cfg->cb_ctx);
+		}
 		if (p2p->after_scan_tx_in_progress) {
 			p2p->after_scan_tx_in_progress = 0;
 			if (p2p->start_after_scan != P2P_AFTER_SCAN_NOTHING &&
diff --git a/src/p2p/p2p_i.h b/src/p2p/p2p_i.h
index 6de3461..420c739 100644
--- a/src/p2p/p2p_i.h
+++ b/src/p2p/p2p_i.h
@@ -389,6 +389,7 @@
 	u8 after_scan_peer[ETH_ALEN];
 	struct p2p_pending_action_tx *after_scan_tx;
 	unsigned int after_scan_tx_in_progress:1;
+	unsigned int send_action_in_progress:1;
 
 	/* Requested device types for find/search */
 	unsigned int num_req_dev_types;
diff --git a/src/p2p/p2p_pd.c b/src/p2p/p2p_pd.c
index 409405f..68d79d2 100644
--- a/src/p2p/p2p_pd.c
+++ b/src/p2p/p2p_pd.c
@@ -224,7 +224,8 @@
 			    p2p->cfg->dev_addr,
 			    wpabuf_head(resp), wpabuf_len(resp), 200) < 0) {
 		p2p_dbg(p2p, "Failed to send Action frame");
-	}
+	} else
+		p2p->send_action_in_progress = 1;
 
 	wpabuf_free(resp);
 
diff --git a/src/rsn_supp/wpa_ie.c b/src/rsn_supp/wpa_ie.c
index 9c11183..610b65a 100644
--- a/src/rsn_supp/wpa_ie.c
+++ b/src/rsn_supp/wpa_ie.c
@@ -522,8 +522,16 @@
 			ie->supp_channels = pos + 2;
 			ie->supp_channels_len = pos[1];
 		} else if (*pos == WLAN_EID_SUPPORTED_OPERATING_CLASSES) {
-			ie->supp_oper_classes = pos + 2;
-			ie->supp_oper_classes_len = pos[1];
+			/*
+			 * The value of the Length field of the Supported
+			 * Operating Classes element is between 2 and 253.
+			 * Silently skip invalid elements to avoid interop
+			 * issues when trying to use the value.
+			 */
+			if (pos[1] >= 2 && pos[1] <= 253) {
+				ie->supp_oper_classes = pos + 2;
+				ie->supp_oper_classes_len = pos[1];
+			}
 		} else if (*pos == WLAN_EID_VENDOR_SPECIFIC) {
 			ret = wpa_parse_generic(pos, end, ie);
 			if (ret < 0)